MCMS vulnerabilities

MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.

MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).

The /cms/category/list interface in MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause via FreeMarker ${size} without parameterization. The SqlInjectionUtil filter does not block keywords like CREATE/TABLE/SET/PREPARE/EXECUTE, allowing bypass and execution of stacked SQL statements without login.

An arbitrary file upload vulnerability was found in the ueditor component of MCMS version 5.4.3. Attackers can exploit this flaw to execute arbitrary code by uploading a crafted file.

MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails` is excluded from the global XSS filter.

Vulnerability in MCMS version 6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.

A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload.

An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code by uploading a crafted file.